The vulnerability arises when a FOU socket is created that binds to local port 0, and the kernel publishes a struct fou through sk_user_data before the port entry is linked into the list. If the addition to the list fails, the object is freed while still referenced. A concurrent receive operation can then dereference freed memory, which triggers a kernel memory corruption. The effect could be local privilege escalation or a system crash.

All active releases of the Linux kernel that express the FOU implementation before the commit that applied the fix are affected. These include the default kernels shipped with mainstream distributions that had not yet incorporated the patch and any custom kernels that left the FOU code unchanged. The CVE data does not list specific kernel versions affected.

The CVSS score of 7.8 indicates a high severity. The EPSS score of <1% signifies a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local and requires the attacker to create a FOU socket with local port 0; this condition limits the exposure. Consequently, while the flaw can lead to kernel memory corruption, the practical risk is mitigated by the low likelihood of exploitation in most environments.